diff --git a/ctypes_generation/definitions/winstruct.txt b/ctypes_generation/definitions/winstruct.txt index 8c019b6..9684849 100644 --- a/ctypes_generation/definitions/winstruct.txt +++ b/ctypes_generation/definitions/winstruct.txt @@ -753,7 +753,17 @@ typedef enum _SE_OBJECT_TYPE { typedef struct _CLIENT_ID{ HANDLE UniqueProcess; HANDLE UniqueThread; - } CLIENT_ID; +} CLIENT_ID; + +typedef struct _CLIENT_ID64{ + ULONG64 UniqueProcess; + ULONG64 UniqueThread; +} CLIENT_ID64; + +typedef struct _CLIENT_ID32{ + ULONG UniqueProcess; + ULONG UniqueThread; +} CLIENT_ID32; typedef struct _LDR_DATA_TABLE_ENTRY { PVOID Reserved1[2]; @@ -2392,9 +2402,15 @@ typedef struct _ALPC_MESSAGE_ATTRIBUTES } ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES; -typedef union _PORT_MESSAGE_TMP_UNION +typedef union _PORT_MESSAGE32_TMP_UNION { - SIZE_T ClientViewSize; + ULONG ClientViewSize; + ULONG CallbackId; +} PORT_MESSAGE_TMP_UNION; + +typedef union _PORT_MESSAGE64_TMP_UNION +{ + ULONGLONG ClientViewSize; ULONG CallbackId; } PORT_MESSAGE_TMP_UNION; @@ -2427,14 +2443,23 @@ typedef union _PORT_MESSAGE_TMP_UNION_U2 } _PORT_MESSAGE_TMP_UNION_U2; -typedef struct _PORT_MESSAGE +typedef struct _PORT_MESSAGE32 { _PORT_MESSAGE_TMP_UNION_U1 u1; _PORT_MESSAGE_TMP_UNION_U2 u2; - CLIENT_ID ClientId; + CLIENT_ID32 ClientId; ULONG MessageId; - _PORT_MESSAGE_TMP_UNION tmp_union; -} PORT_MESSAGE, *PPORT_MESSAGE; + _PORT_MESSAGE32_TMP_UNION tmp_union; +} PORT_MESSAGE32, *PPORT_MESSAGE32; + +typedef struct _PORT_MESSAGE64 +{ + _PORT_MESSAGE_TMP_UNION_U1 u1; + _PORT_MESSAGE_TMP_UNION_U2 u2; + CLIENT_ID64 ClientId; + ULONG MessageId; + _PORT_MESSAGE64_TMP_UNION tmp_union; +} PORT_MESSAGE64, *PPORT_MESSAGE64; typedef struct _SERVICE_STATUS { diff --git a/ctypes_generation/generate.py b/ctypes_generation/generate.py index 50f3e42..a6da456 100644 --- a/ctypes_generation/generate.py +++ b/ctypes_generation/generate.py @@ -305,6 +305,9 @@ class StructGenerator(CtypesGenerator): except: self.add_imports(nb_rep) + # We have PPORT_MESSAGE32 and PPORT_MESSAGE64 and PPORT_MESSAGE is choosed at runtime + self.add_exports("PPORT_MESSAGE") + def generate(self): type_equivalences = "\n".join(["{0} = {1}".format(*x) for x in TYPE_EQUIVALENCE]) diff --git a/windows/alpc.py b/windows/alpc.py index f090b7b..57dc6a6 100644 --- a/windows/alpc.py +++ b/windows/alpc.py @@ -125,7 +125,8 @@ def send_receive_data(port_handle, data): size = gn.SIZE_T(0x1000) receive = AlpcMessage(size.value) receive_attr = MessageAttribute(0) - + # Its strange that this line does not always have the same effect has the one bellow + # winproxy.NtAlpcSendWaitReceivePort(port_handle, ALPC_MSGFLG_SYNC_REQUEST, sendmsg, sendmsg_attr, receive, ctypes.byref(size), receive_attr, None) winproxy.NtAlpcSendWaitReceivePort(port_handle, ALPC_MSGFLG_SYNC_REQUEST, sendmsg, sendmsg_attr, receive, size, receive_attr, None) return receive_attr, receive diff --git a/windows/debug/breakpoints.py b/windows/debug/breakpoints.py index 5ca1247..d8500f7 100644 --- a/windows/debug/breakpoints.py +++ b/windows/debug/breakpoints.py @@ -74,7 +74,12 @@ class X64ArgumentRetriever(object): ## Behaviour breakpoint ! class FunctionParamDumpBP(Breakpoint): - def __init__(self, target, addr=None): + def __init__(self, target=None, addr=None): + if target is None: + try: + target = self.TARGET + except AttributeError as e: + raise ValueError("{0} bp without a must have a class attribute") if addr is None: addr = "{0}!{1}".format(target.target_dll, target.target_func) super(FunctionParamDumpBP, self).__init__(addr) diff --git a/windows/generated_def/__init__.py b/windows/generated_def/__init__.py index c8496c7..576bbcc 100644 --- a/windows/generated_def/__init__.py +++ b/windows/generated_def/__init__.py @@ -22,6 +22,9 @@ if bitness() == 32: winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES32 winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES32 + winstructs.PORT_MESSAGE = winstructs.PORT_MESSAGE32 + winstructs.PPORT_MESSAGE = winstructs.PPORT_MESSAGE32 + else: winstructs.CONTEXT = winstructs.CONTEXT64 winstructs.PCONTEXT = winstructs.PCONTEXT64 @@ -36,6 +39,9 @@ else: winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES64 winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES64 + winstructs.PORT_MESSAGE64 = winstructs.PORT_MESSAGE64 + winstructs.PPORT_MESSAGE64 = winstructs.PPORT_MESSAGE64 + from . import winfuncs from . import windef diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index 059f5fe..5f0a4c9 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -1108,6 +1108,20 @@ class _CLIENT_ID(Structure): ] CLIENT_ID = _CLIENT_ID +class _CLIENT_ID64(Structure): + _fields_ = [ + ("UniqueProcess", ULONG64), + ("UniqueThread", ULONG64), + ] +CLIENT_ID64 = _CLIENT_ID64 + +class _CLIENT_ID32(Structure): + _fields_ = [ + ("UniqueProcess", ULONG), + ("UniqueThread", ULONG), + ] +CLIENT_ID32 = _CLIENT_ID32 + class _LDR_DATA_TABLE_ENTRY(Structure): _fields_ = [ ("Reserved1", PVOID * 2), @@ -3049,12 +3063,19 @@ class _ALPC_MESSAGE_ATTRIBUTES(Structure): ALPC_MESSAGE_ATTRIBUTES = _ALPC_MESSAGE_ATTRIBUTES PALPC_MESSAGE_ATTRIBUTES = POINTER(_ALPC_MESSAGE_ATTRIBUTES) -class _PORT_MESSAGE_TMP_UNION(Union): +class _PORT_MESSAGE32_TMP_UNION(Union): _fields_ = [ - ("ClientViewSize", SIZE_T), + ("ClientViewSize", ULONG), ("CallbackId", ULONG), ] -PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE_TMP_UNION +PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE32_TMP_UNION + +class _PORT_MESSAGE64_TMP_UNION(Union): + _fields_ = [ + ("ClientViewSize", ULONGLONG), + ("CallbackId", ULONG), + ] +PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE64_TMP_UNION class _PORT_MESSAGE_TMP_SUBSTRUCT_S1(Structure): _fields_ = [ @@ -3084,16 +3105,27 @@ class _PORT_MESSAGE_TMP_UNION_U2(Union): ] _PORT_MESSAGE_TMP_UNION_U2 = _PORT_MESSAGE_TMP_UNION_U2 -class _PORT_MESSAGE(Structure): +class _PORT_MESSAGE32(Structure): _fields_ = [ ("u1", _PORT_MESSAGE_TMP_UNION_U1), ("u2", _PORT_MESSAGE_TMP_UNION_U2), - ("ClientId", CLIENT_ID), + ("ClientId", CLIENT_ID32), ("MessageId", ULONG), - ("tmp_union", _PORT_MESSAGE_TMP_UNION), + ("tmp_union", _PORT_MESSAGE32_TMP_UNION), ] -PPORT_MESSAGE = POINTER(_PORT_MESSAGE) -PORT_MESSAGE = _PORT_MESSAGE +PORT_MESSAGE32 = _PORT_MESSAGE32 +PPORT_MESSAGE32 = POINTER(_PORT_MESSAGE32) + +class _PORT_MESSAGE64(Structure): + _fields_ = [ + ("u1", _PORT_MESSAGE_TMP_UNION_U1), + ("u2", _PORT_MESSAGE_TMP_UNION_U2), + ("ClientId", CLIENT_ID64), + ("MessageId", ULONG), + ("tmp_union", _PORT_MESSAGE64_TMP_UNION), + ] +PPORT_MESSAGE64 = POINTER(_PORT_MESSAGE64) +PORT_MESSAGE64 = _PORT_MESSAGE64 class _SERVICE_STATUS(Structure): _fields_ = [ diff --git a/windows/winobject/process.py b/windows/winobject/process.py index 3fad120..a5886d2 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -11,6 +11,7 @@ from collections import namedtuple import windows import windows.native_exec.simple_x86 as x86 import windows.native_exec.simple_x64 as x64 +import windows.remotectypes as rctypes from windows import injection from windows import native_exec @@ -1395,9 +1396,6 @@ class EPSAPI_WORKING_SET_EX_INFORMATION64(ctypes.Structure): _fields_ = windows.utils.transform_ctypes_fields(PSAPI_WORKING_SET_EX_INFORMATION64, {"VirtualAttributes": EPSAPI_WORKING_SET_EX_BLOCK64}) -import windows.remotectypes as rctypes - - class RemoteLoadedModule(rctypes.RemoteStructure.from_structure(LoadedModule)): @property def pe(self):